{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1498 Network Denial of Service","home_page_url":"https://patchfirst.co/technique/T1498/","feed_url":"https://patchfirst.co/feed/technique/T1498.json","description":"New and newly exploited CVEs that lead to ATT&CK T1498 Network Denial of Service, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2025-6543#kev","url":"https://patchfirst.co/cve/CVE-2025-6543/","title":"[KEV] CVE-2025-6543: Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability","content_text":"Citrix · NetScaler ADC and Gateway. In CISA KEV since 2025-06-30. ENISA EUVD lists it as exploited. EPSS 10.4% (higher than 95.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1498 Network Denial of Service; T1059 Command and Scripting Interpreter. Priority 69.0 of 100.","summary":"Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability","date_published":"2025-06-30T00:00:00.000Z","date_modified":"2026-06-17T10:02:07.000Z","tags":["kev","public-exploit","T1498","T1059"],"_patchfirst":{"reason":"kev","priority":69,"kev":{"dateAdded":"2025-06-30","ransomware":false},"epss":{"score":0.10433,"percentile":0.95731},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"NetScaler ADC and Gateway","techniqueIds":["T1498","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-11120#kev","url":"https://patchfirst.co/cve/CVE-2024-11120/","title":"[KEV] CVE-2024-11120: GeoVision Devices OS Command Injection Vulnerability","content_text":"GeoVision · Multiple Devices. In CISA KEV since 2025-05-07. ENISA EUVD lists it as exploited. EPSS 28.4% (higher than 98.1% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1498 Network Denial of Service. Priority 69.5 of 100.","summary":"GeoVision Devices OS Command Injection Vulnerability","date_published":"2025-05-07T00:00:00.000Z","date_modified":"2026-06-17T06:57:06.000Z","tags":["kev","public-exploit","T1133","T1498"],"_patchfirst":{"reason":"kev","priority":69.5,"kev":{"dateAdded":"2025-05-07","ransomware":false},"epss":{"score":0.28386,"percentile":0.9812},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"GeoVision","product":"Multiple Devices","techniqueIds":["T1133","T1498"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-49897#kev","url":"https://patchfirst.co/cve/CVE-2023-49897/","title":"[KEV] CVE-2023-49897: FXC AE1021, AE1021PE OS Command Injection Vulnerability","content_text":"FXC · AE1021, AE1021PE. In CISA KEV since 2023-12-21. ENISA EUVD lists it as exploited. EPSS 50.4% (higher than 98.9% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1496 Resource Hijacking; T1498 Network Denial of Service. Priority 68.9 of 100.","summary":"FXC AE1021, AE1021PE OS Command Injection Vulnerability","date_published":"2023-12-21T00:00:00.000Z","date_modified":"2026-06-17T06:36:40.000Z","tags":["kev","public-exploit","T1496","T1498"],"_patchfirst":{"reason":"kev","priority":68.9,"kev":{"dateAdded":"2023-12-21","ransomware":false},"epss":{"score":0.50447,"percentile":0.98911},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"FXC","product":"AE1021, AE1021PE","techniqueIds":["T1496","T1498"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-47565#kev","url":"https://patchfirst.co/cve/CVE-2023-47565/","title":"[KEV] CVE-2023-47565: QNAP VioStor NVR OS Command Injection Vulnerability","content_text":"QNAP · VioStor NVR. In CISA KEV since 2023-12-21. ENISA EUVD lists it as exploited. EPSS 73.3% (higher than 99.46% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1496 Resource Hijacking; T1498 Network Denial of Service. Priority 64.1 of 100.","summary":"QNAP VioStor NVR OS Command Injection Vulnerability","date_published":"2023-12-21T00:00:00.000Z","date_modified":"2026-06-17T06:32:55.000Z","tags":["kev","T1496","T1498"],"_patchfirst":{"reason":"kev","priority":64.1,"kev":{"dateAdded":"2023-12-21","ransomware":false},"epss":{"score":0.73277,"percentile":0.99458},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"QNAP","product":"VioStor NVR","techniqueIds":["T1496","T1498"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-1389#kev","url":"https://patchfirst.co/cve/CVE-2023-1389/","title":"[KEV] CVE-2023-1389: TP-Link Archer AX-21 Command Injection Vulnerability","content_text":"TP-Link · Archer AX21. In CISA KEV since 2023-05-01. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1106 Native API; T1496 Resource Hijacking; T1041 Exfiltration Over C2 Channel; T1070 Indicator Removal; T1498 Network Denial of Service. Priority 69.2 of 100.","summary":"TP-Link Archer AX-21 Command Injection Vulnerability","date_published":"2023-05-01T00:00:00.000Z","date_modified":"2026-06-17T05:27:50.000Z","tags":["kev","public-exploit","T1106","T1496","T1041","T1070","T1498"],"_patchfirst":{"reason":"kev","priority":69.2,"kev":{"dateAdded":"2023-05-01","ransomware":false},"epss":{"score":0.99999,"percentile":0.99992},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"TP-Link","product":"Archer AX21","techniqueIds":["T1106","T1496","T1041","T1070","T1498"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-0028#kev","url":"https://patchfirst.co/cve/CVE-2022-0028/","title":"[KEV] CVE-2022-0028: Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability","content_text":"Palo Alto Networks · PAN-OS. In CISA KEV since 2022-08-22. ENISA EUVD lists it as exploited. EPSS 2.7% (higher than 85.9% of CVEs). CVSS 8.6 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1498 Network Denial of Service. Priority 61.2 of 100.","summary":"Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability","date_published":"2022-08-22T00:00:00.000Z","date_modified":"2026-06-17T04:19:55.000Z","tags":["kev","T1190","T1498"],"_patchfirst":{"reason":"kev","priority":61.2,"kev":{"dateAdded":"2022-08-22","ransomware":false},"epss":{"score":0.0269,"percentile":0.85858},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Palo Alto Networks","product":"PAN-OS","techniqueIds":["T1190","T1498"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-26143#kev","url":"https://patchfirst.co/cve/CVE-2022-26143/","title":"[KEV] CVE-2022-26143: MiCollab, MiVoice Business Express Access Control Vulnerability","content_text":"Mitel · MiCollab, MiVoice Business Express. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 87.3% (higher than 99.75% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1498 Network Denial of Service. Priority 69.8 of 100.","summary":"MiCollab, MiVoice Business Express Access Control Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T04:34:46.000Z","tags":["kev","public-exploit","T1190","T1498"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.87325,"percentile":0.99753},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Mitel","product":"MiCollab, MiVoice Business Express","techniqueIds":["T1190","T1498"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-0708#kev","url":"https://patchfirst.co/cve/CVE-2019-0708/","title":"[KEV] CVE-2019-0708: Microsoft Remote Desktop Services Remote Code Execution Vulnerability","content_text":"Microsoft · Remote Desktop Services. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1498 Network Denial of Service. Named in 2 threat reports. Priority 86.0 of 100.","summary":"Microsoft Remote Desktop Services Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:08:44.000Z","tags":["kev","ransomware","public-exploit","T1133","T1498"],"_patchfirst":{"reason":"kev","priority":86,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99999,"percentile":0.99999},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Microsoft","product":"Remote Desktop Services","techniqueIds":["T1133","T1498"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-22205#kev","url":"https://patchfirst.co/cve/CVE-2021-22205/","title":"[KEV] CVE-2021-22205: GitLab Community and Enterprise Editions Remote Code Execution Vulnerability","content_text":"GitLab · Community and Enterprise Editions. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1498 Network Denial of Service; T1496 Resource Hijacking. Priority 80.0 of 100.","summary":"GitLab Community and Enterprise Editions Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-06T05:16:35.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1498","T1496"],"_patchfirst":{"reason":"kev","priority":80,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99731,"percentile":0.99953},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"GitLab","product":"Community and Enterprise Editions","techniqueIds":["T1190","T1059","T1498","T1496"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}